do-readv_writev() is trying to fail if

a) any of the segments have a length < 0 or

b) the sum of the segments wraps negative.

But it gets b) wrong because local variable tot_len is unsigned.

Fix that up.


---

 25-akpm/fs/read_write.c |    6 +++---
 1 files changed, 3 insertions(+), 3 deletions(-)

diff -puN fs/read_write.c~readv-writev-check-fix fs/read_write.c
--- 25/fs/read_write.c~readv-writev-check-fix	2004-04-03 02:59:57.015685240 -0800
+++ 25-akpm/fs/read_write.c	2004-04-03 02:59:57.018684784 -0800
@@ -412,13 +412,13 @@ static ssize_t do_readv_writev(int type,
 	 */
 	tot_len = 0;
 	ret = -EINVAL;
-	for (seg = 0 ; seg < nr_segs; seg++) {
-		ssize_t tmp = tot_len;
+	for (seg = 0; seg < nr_segs; seg++) {
 		ssize_t len = (ssize_t)iov[seg].iov_len;
+
 		if (len < 0)	/* size_t not fitting an ssize_t .. */
 			goto out;
 		tot_len += len;
-		if (tot_len < tmp) /* maths overflow on the ssize_t */
+		if ((ssize_t)tot_len < 0) /* maths overflow on the ssize_t */
 			goto out;
 	}
 	if (tot_len == 0) {

_